HTTP Status Codes
Guides explaining HTTP status codes, what causes them, and how to fix them.
HTTP 404 Not Found: Hunting Down Dead Pages Before Google Does
The 404 is the only status code with its own memes, yet most site owners can't say how many they're serving right now. Here's where dead URLs come from, which ones matter, and a triage system for what to do with each.
HTTP 410 Gone: The Deliberate Way to Kill a URL
404 says "I can't find that." 410 says "it existed, it's gone, and it isn't coming back — stop asking." That difference is invisible to most visitors but meaningful to Googlebot, which retires 410 URLs faster. Here's when the 410 status code is the right call and how to serve it properly.
302 Status Code: The Temporary Redirect That Overstays
Most 302 redirects I find in audits were never meant to be temporary — they're the accidental output of a default setting. Here's what a 302 actually signals, how Google interprets one that never goes away, and how to find yours.
HTTP 307 Temporary Redirect vs 302: What Changes and Why
The 307 redirect exists because 302 made a promise browsers never kept. If you've ever lost form data through a redirect, or wondered why Chrome shows '307 Internal Redirect' for HTTPS sites, this is the code responsible.
HTTP 401 Unauthorized: Fixing Authentication Failures Fast
A 401 isn't the server saying no — it's the server saying 'prove who you are, then ask again.' That distinction, and one response header, is the key to debugging every authentication failure from basic auth popups to expired API tokens.
400 Status Code: Decoding the Bad Request Error
'Bad Request' is the server refusing to even try — and the frustrating part is that the fault sits somewhere in the request itself. Here's how to figure out which part, from cookie bloat to mangled URLs to header limits.
HTTP 403 Forbidden: Six Causes and How to Rule Each One Out
Forbidden is the server's least helpful refusal — it understood you perfectly and won't say why it said no. These are the six causes behind nearly every 403 I've debugged, ordered by how fast you can rule each one out.
HTTP 200 OK: When Success Hides a Soft 404
A 200 response means the server delivered something — not that it delivered the right thing. Here's how to read HTTP 200 correctly and catch the soft 404s and broken pages hiding behind it.
HTTP 304 Not Modified: The Response That Saves Bandwidth
A network tab full of 304s isn't a problem — it's your caching layer doing its job. This is how conditional requests work, why Googlebot rewards sites that answer 304 correctly, and what to check when yours stop showing up.
HTTP 429 Too Many Requests: Rate Limits Explained
The 429 status code is a server enforcing a speed limit — and it cuts both ways. Sometimes you're serving them to a scraper hammering your search page; sometimes Googlebot is the one being throttled and your crawl stats quietly crater. Here's how rate limiting works, how to read the headers, and how to fix 429s on both sides.
HTTP 520: Decoding Cloudflare's Unknown Error
520 is Cloudflare's junk drawer: the code it returns when your origin sent back something it couldn't classify as any specific failure. Empty responses, crashed connections, oversized headers — they all land here. The real error exists; it's just hiding at your origin, and this is how you dig it out.
HTTP 503 Service Unavailable: Overload, Maintenance, Fixes
503 is the only server error you'll ever send on purpose. Done right — with a Retry-After header during maintenance — it tells Google "come back later" and costs you nothing. Done wrong, or left running for weeks, it drains your crawl rate and your index. Here's both sides of the 503 status code.
HTTP 408 Request Timeout: Why the Server Gave Up Waiting
A 408 isn't the server being slow — it's the server getting impatient with a client that started a request and never finished it. Here's where that timeout actually fires, why mobile networks and half-open connections are the usual suspects, and how to tune your timeouts without cutting off legitimate slow clients.
HTTP 504 Gateway Timeout: Tracing the Slow Upstream
A 504 isn't a crash — everything in the chain was alive, one layer was just slower than another layer's patience. Usually that means a slow database query meeting a 60-second proxy timeout. Here's how to find which layer burned the time, and whether to fix the slowness or the deadline.
HTTP 405 Method Not Allowed: Why Your POST Just Got Rejected
A 405 is oddly reassuring once you can read it: the URL is real, the server is healthy, and exactly one thing is wrong — the verb. Here's how to read the Allow header and fix the method mismatch behind almost every one.
HTTP 521 Web Server Is Down: A Cloudflare Triage Guide
Your visitors see Cloudflare's error page and assume Cloudflare broke. It didn't — a 521 means your origin actively refused Cloudflare's connection. Web server stopped, firewall blocking Cloudflare's IPs, or a port mismatch: it's nearly always one of three things, and each takes minutes to confirm.
HTTP 522 Connection Timed Out: Cloudflare Can't Reach You
Before any web page loads, two machines must complete a three-step TCP handshake — and a 522 means that handshake never finished between Cloudflare and your origin. Nobody refused; the packets just vanished. That word "vanished" is the clue: silent drops mean firewalls, dead routes, or a server too swamped to say hello.
HTTP 301 Moved Permanently: The Redirect That Carries Weight
The 301 redirect is the closest thing SEO has to a forwarding address that actually works. Get it right and your rankings follow the content; get it wrong and years of link equity leak away one hop at a time.
HTTP 308 Permanent Redirect: 301's Stricter Sibling
308 is the youngest and least-used member of the redirect family, and most sites will never need it — until they move an API endpoint and discover why it exists. Here's what HTTP 308 guarantees that a 301 doesn't.
HTTP 500 Internal Server Error: A Field Guide to Fixing It
A 500 error is the server's way of saying "something went wrong and I'm not telling you what." The real answer is always in a log file somewhere. This guide walks through the first five minutes of a 500 investigation, the causes that account for most incidents, and what sustained 500s do to your search presence.